<div dir="ltr">Thank you Mark, you explanation highlights one of the key issues of this debate:<br><div><br></div><div>What is an urgent issue for one party may not be the same for another. <br></div><div><br></div><div>Ultimately we will need an objective standard to measure urgency. The ones I believe we had already agreed to was life and death situations and imminent terrorist attacks. Another issue is trust in the reporter. Again, this is something that is easier to attribute to law enforcement of appropriate jurisdiction than to other reporters from the private sector as the latter have no checks and balances and may be motivated by other influences. Handling a request with urgency reduces our ability to verify the accusations made in the request. Many of the issues you describe are not verifiable by contracted parties and need to be believed or taken at face value. So trust is an issue. <br></div><div><br></div><div>All in all, I am open to considering other matters for urgency, but these will have to be carefully considered and weighed against the risks. <br></div><div><br></div><div>We also need to consider that these requests will not end the threats you describe. Is it really that urgent to get the registration data for a domain when a private enterprise like a bank is under attack by a ransomware operation? Do the security folks not have more important things to deal with at such times, like stopping the attacks or the domains from resolving? Will knowing the data that the registrant provided at the time of registration really end the attack? It may help, but is it really that urgent to know?<br></div><div><br></div><div>Finally, if you open the gates too much, the special queue may become useless. I do not subscribe to the opinion of the Texan Lt. Gov that there are more important things than living. Life is the most important to protect. Everything else comes later. <br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span lang="EN-US">-- <br>Volker A. Greimann<br>General Counsel and Policy Manager<br><b>KEY-SYSTEMS GMBH</b><br><br>T: +49 6894 9396901<br>M: +49 6894 9396851<br>F: +49 6894 9396851<br>W: </span><a href="http://www.key-systems.net/" style="color:rgb(17,85,204)" target="_blank"><span lang="EN-US">www.key-systems.net</span></a><span lang="EN-US"><br><br>Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835<br>CEO: Oliver Fries and Robert Birkner<br><br>Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.</span><br></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 23, 2020 at 7:22 AM Mark Svancarek (CELA) via Gnso-epdp-team <<a href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_4089757305539364400WordSection1">
<p class="MsoNormal">Although we’ve always discussed urgent priority requests as being available to both LEA and non-LEA, we are regularly asked why non-LEA should be allowed to use this type of request. We’ve seen this again in the public comments, with new
suggestions that a non-LEA requestor must route urgent requests through a government agency rather than making such a request themselves.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">To clarify why it’s not sufficient to limit these requests to law enforcement and government agents, I asked my Digital Crime Unit and state actor cyberdefense teams for details. Here’s what they said.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ul style="margin-top:0in" type="disc">
<li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>Law enforcement (LE) and Microsoft priorities do not always overlap such that what we consider an emergency, where this information could be
necessary to protect our customers ( such as a threat to our infrastructure or our customer’s infrastructure), is the same as an emergency for LE.<u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>The threshold for what is important to protect our customers is often different or lower than the threshold for a LE emergency as outlined
below – but nonetheless just as important. <u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>When a customer or partner is under attack, we would not necessarily engage LE. We would only notify/contact the customer directly since the
impact is on their tenant. LE engagement is then at their discretion.<u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>Here are some scenarios where we would likely make urgent data requests separate from LE engagement:
<u></u><u></u></span></li><ul style="margin-top:0in" type="circle">
<li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>a large banking establishment or school district under ransomware attack<u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>a nation state actor targeting multiple human rights organizations with persistent spear phishing attacks<u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>a nation state actor using a malicious domain to compromise and steal information from members of the United Nations<u></u><u></u></span></li><li class="gmail-m_4089757305539364400MsoListParagraph" style="margin-left:0in"><span>a nation state actor purchasing large swaths of domains to target multiple organizations in the oil and gas industry, then using them in a
large-scale intrusion campaign<u></u><u></u></span></li></ul>
</ul>
<p class="MsoNormal" style="margin-left:0.25in"><span><u></u> <u></u></span></p>
<p class="MsoNormal">Remember that abuse of the Urgent Priority request mechanism is already defined as an activity which may lead to loss of accreditation, even for LEA. That safeguard would be certainly be invoked quickly if the privilege were abused by
a non-LEA requester.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I look forward to discussing this topic soon.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">/marksv<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Gnso-epdp-team mailing list<br>
<a href="mailto:Gnso-epdp-team@icann.org" target="_blank">Gnso-epdp-team@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</blockquote></div>